There may be cases where admin privileges are only needed for optional (and possibly very specific functions of) sub-programs or plugins of the main program. That is, cases where the main program doesn't need it. In those cases, it's a major no-no to keep bothering the user. A try_once option would only ask the question one time.
installer.ini might be an alternative place for such an option.
Please consider this.
If an app has some functions that require admin that a user would normally use, it should ask. If an app requires admin, it asks and closes if denied. I've never seen an app with the situation you are mentioning.
Sometimes, the impossible can become possible, if you're awesome!
You probably saw it coming but that's one app with this scenario. The GUI doesn't even use the registry. And Blat itself uses the registry only if you tell it to manually.
So basically, I rather the program to fail in the 1% chance registry is used, then have it asked every time it's launched.
If it's using HKCU, it'll work fine. If it's using HKLM, that's poor software design. In that case, both the app and the admin will fail if you don't have admin rights. So just set it to backup that reg key in the launcher and if you have rights, both will work, if you don't, both will fail. No admin or UAC necessary. We have multiple apps that will only use the registry HKLM with admin rights and, if you don't, just not be able to. None of them are configured with admin rights.
As a general rule, we do not accept apps that require admin rights unless they are system level tools (since those are the only ones that should require it).
Sometimes, the impossible can become possible, if you're awesome!
I've already set it to back up the key. If it's enough, when is the RunAsAdmin setting ever needed?
But even if I turn on this secret option, I can't force users not to remove it and revert the program to needing admin privileges. Is it enough of their fault not to trigger usage of RunAsAdmin?
It's fine as is.
The only apps we have that require admin are JkDefrag, SpyBot and SpyDLLRemover. They require admin because the apps themselves require admin to properly run as they all modify actual system-level stuff. Something like a mail client frontend should absolutely not require admin.
Sometimes, the impossible can become possible, if you're awesome!